JNCIP-SEC key terms

A logical grouping of one or more interfaces that share common security policy and host-inbound service settings; traffic entering or leaving the zone is evaluated by zone-based policies.

A policy configured in the global policy context that applies across all zones before zone-specific policies; it is used for consistent rules such as default deny, logging, or threat enforcement.

Conditions such as source and destination zone, address, application, user, or dynamic application that a packet must satisfy before the policy action is applied.

A stateful entry in the flow table created for the first packet of a permitted flow, storing forwarding, NAT, and inspection state for subsequent packets in that flow.

A troubleshooting mechanism that records packet-processing decisions-policy lookup, NAT, and forwarding-for a specific five-tuple, showing why traffic is permitted, denied, or dropped.

Traffic destined to the device itself, such as management, routing protocols, or ICMP; it is controlled per zone and interface through host-inbound-traffic system services and protocols.

A partitioned administrative and security context within one device, with its own policies, zones, users, and routing instances while sharing physical resources with other logical systems.

A tenant-level partition inside a logical system that provides separate policy, zone, and routing configuration for multitenancy; supported on certain Junos security platforms.

The default logical system on a device that owns shared physical interfaces and assigns them to other logical systems; administrators use it to create and manage LSYS instances.

Per-LSYS caps on objects such as policies, zones, address books, and sessions, used to prevent one tenant from exhausting device-wide resources.

A Layer 2 deployment in which the firewall bridges traffic between interfaces without an IP address on the forwarding path, applying security policies and screens to switched frames.

A Juniper Layer 2 security feature that transparently forwards traffic between a pair of interfaces while applying firewall inspection, often used to insert security without re-IP addressing.

A Layer 2 security feature that caps the number of learned MAC addresses per interface or VLAN, dropping frames when the limit is exceeded to mitigate MAC flooding.

A Layer 2 feature that filters untrusted DHCP server messages and builds a binding table of client IP-to-MAC mappings used by DAI and IP source guard.

A Layer 2 protection that validates ARP packets against the DHCP snooping binding table, dropping forged ARP replies used in man-in-the-middle attacks.

Translation that changes the source IP address and optionally port of outbound packets, often to a pool or interface address, so internal hosts can reach external networks.

Translation that changes the destination IP address and optionally port of inbound packets, typically to redirect external connections to an internal server.

A one-to-one mapping between a private address and a public address that applies in both directions and does not use port translation.

A NAT behavior that keeps a binding for a client so that external hosts can initiate sessions back to the same internal address and port for a configured timeout.

The sequence in which NAT rulesets are evaluated; the first matching rule is applied, so rule placement determines which translation and pool are used.

The configuration object defining the remote peer address, authentication method, and IKE proposals used to establish the phase 1 security association for an IPsec VPN.

A set of phase 2 parameters-encryption, authentication, and protocol such as ESP or AH-negotiated for the child security association protecting data traffic.

An IPsec deployment that binds the tunnel to a tunnel interface (st0) and uses routing to direct traffic into it, allowing dynamic routing and multiple subnets.

The local and remote address and port ranges that define which traffic is protected by an IPsec policy-based VPN; mismatches commonly cause phase 2 failures.

A keepalive mechanism that probes the peer at configured intervals and tears down or renegotiates the IPsec tunnel when the peer becomes unreachable.

A Juniper hub-and-spoke IPsec feature where spokes use a shared gateway configuration and the hub dynamically creates tunnels and installs routes without per-spoke configuration.

Application-aware policy-based routing that classifies traffic using application signatures and other match criteria, then forwards matching flows to a specified next hop or routing instance.

A component of an APBR policy that defines match conditions and the action-such as next hop, interface, or routing instance-applied to traffic that matches the rule.

A reusable set of APBR settings, including application signatures and match conditions, attached to an APBR policy to classify and steer traffic.

A pattern or set of heuristics used by Junos application identification to recognize an application, which APBR can use as a routing match criterion.

Two Juniper devices connected by control and fabric links that operate as a single high-availability system with synchronized sessions and redundant redundancy groups.

A chassis cluster object that owns a set of monitored interfaces and defines which node is primary, allowing selective failover of services between nodes.

The dedicated connection between cluster nodes that carries heartbeat, configuration synchronization, and state information; its failure can cause split-brain or failover.

The high-speed data path between cluster nodes used to forward traffic when a session's active path is on the peer or when traffic must traverse the other node.

The process of replicating session state from the active node to the backup node so that established flows survive a failover.

A cloud-delivered threat intelligence and malware analysis service that provides SecIntel feeds, DNS filtering, and infected-host detection to supported Junos security devices.

A Juniper threat intelligence feed service that delivers command-and-control, malware, and geo-IP blocklists to firewalls for automated enforcement in security policies.

An internal endpoint identified by ATP Cloud as communicating with malicious infrastructure; the firewall can quarantine or block its traffic automatically.

A threat mitigation feature that blocks DNS queries to known malicious domains, preventing resolution and subsequent connections to attacker infrastructure.